EUVD-2026-68525Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable GraphQL endpoint, no auth, trivially exploitable single query; only availability impacted.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the allocation of extremely large BigInteger objects, causing CPU exhaustion or an OutOfMemoryError, resulting in a denial of service.
AnalysisAI
Denial of service in SmallRye GraphQL allows unauthenticated remote attackers to exhaust server CPU or heap memory by submitting a GraphQL query containing a large-exponent float literal (e.g., 1e999999999) that triggers unconstrained BigInteger allocation during scalar coercion. Affected deployments include any application built on Red Hat Build of Quarkus that exposes a GraphQL endpoint via SmallRye GraphQL. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target application must be built on Red Hat Build of Quarkus and must expose at least one GraphQL endpoint powered by SmallRye GraphQL that accepts a field typed as BigInteger (or a scalar that coerces to BigInteger) in its schema. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the real-world risk: network-accessible, zero authentication, low complexity, and full availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-76763 for the specific patched version of Red Hat Build of Quarkus - no exact fix version was provided in the available intelligence data, so upgrading to the latest Red Hat-released Quarkus build is the recommended first action. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Quarkus deployments exposing GraphQL endpoints and assess public network accessibility; implement immediate input validation on GraphQL scalars to reject float literals with exponents exceeding 100 and enable query complexity and depth limits at the resolver level. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Build Of Quarkus
View allServer-side template injection in the Qute template engine's ReflectionValueResolver allows authenticated remote attacke
Unauthenticated remote file read in RESTEasy's SourceProvider component allows network attackers to exfiltrate arbitrary
WildFly Elytron's password hashing and verification subsystem silently normalizes Unicode input via NFKC before hashing,
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today